chore(core): bump the tar-fs dep version (#7230)

* chore(core): bump the tar-fs dep version bump the tar-fs dep version to resolve the secuiry issue * chore: update tar-fs version control update tar-fs version control
2025-04-07 23:01:25 -05:00 · 2025-04-03 20:39:00 +08:00 · 2025-04-03 20:39:00 +08:00 · 1b03bd6f86
commit 1b03bd6f86
parent a4d724782d
2 changed files with 76 additions and 23 deletions
--- a/package.json
+++ b/package.json
@ -59,7 +59,8 @@
      "rollup@>=4.0.0 <4.22.4": "^4.22.4",
      "vite@>=5.0.0 <5.4.12": "^5.4.12",
      "ws@>=8.0.0 <8.17.1": "^8.18.0",
-      "xml-crypto@3.0.1": "^3.2.1"
+      "xml-crypto@3.0.1": "^3.2.1",
+      "tar-fs@>=3.0.0 < 3.0.8": "^3.0.8"
    },
    "peerDependencyRules": {
      "allowedVersions": {
--- a/pnpm-lock.yaml
+++ b/pnpm-lock.yaml
@ -23,6 +23,7 @@ overrides:
  vite@>=5.0.0 <5.4.12: ^5.4.12
  ws@>=8.0.0 <8.17.1: ^8.18.0
  xml-crypto@3.0.1: ^3.2.1
+  tar-fs@>=3.0.0 < 3.0.8: ^3.0.8

 importers:

@ -8058,17 +8059,35 @@ packages:
  balanced-match@2.0.0:
    resolution: {integrity: sha512-1ugUSr8BHXRnK23KfuYS+gVMC3LB8QGH9W1iGtDPsNWoQbgtXSExkBu2aDR4epiGWZOjZsj6lDl/N/AqqTC3UA==}

-  bare-events@2.2.2:
-    resolution: {integrity: sha512-h7z00dWdG0PYOQEvChhOSWvOfkIKsdZGkWr083FgN/HyoQuebSew/cgirYqh9SCuy/hRvxc5Vy6Fw8xAmYHLkQ==}
+  bare-events@2.5.4:
+    resolution: {integrity: sha512-+gFfDkR8pj4/TrWCGUGWmJIkBwuxPS5F+a5yWjOHQt2hHvNZd5YLzadjmDUtFmMM4y429bnKLa8bYBMHcYdnQA==}

-  bare-fs@2.2.3:
-    resolution: {integrity: sha512-amG72llr9pstfXOBOHve1WjiuKKAMnebcmMbPWDZ7BCevAoJLpugjuAPRsDINEyjT0a6tbaVx3DctkXIRbLuJw==}
+  bare-fs@4.0.2:
+    resolution: {integrity: sha512-S5mmkMesiduMqnz51Bfh0Et9EX0aTCJxhsI4bvzFFLs8Z1AV8RDHadfY5CyLwdoLHgXbNBEN1gQcbEtGwuvixw==}
+    engines: {bare: '>=1.16.0'}
+    peerDependencies:
+      bare-buffer: '*'
+    peerDependenciesMeta:
+      bare-buffer:
+        optional: true

-  bare-os@2.2.1:
-    resolution: {integrity: sha512-OwPyHgBBMkhC29Hl3O4/YfxW9n7mdTr2+SsO29XBWKKJsbgj3mnorDB80r5TiCQgQstgE5ga1qNYrpes6NvX2w==}
+  bare-os@3.6.1:
+    resolution: {integrity: sha512-uaIjxokhFidJP+bmmvKSgiMzj2sV5GPHaZVAIktcxcpCyBFFWO+YlikVAdhmUo2vYFvFhOXIAlldqV29L8126g==}
+    engines: {bare: '>=1.14.0'}

-  bare-path@2.1.1:
-    resolution: {integrity: sha512-OHM+iwRDRMDBsSW7kl3dO62JyHdBKO3B25FB9vNQBPcGHMo4+eA8Yj41Lfbk3pS/seDY+siNge0LdRTulAau/A==}
+  bare-path@3.0.0:
+    resolution: {integrity: sha512-tyfW2cQcB5NN8Saijrhqn0Zh7AnFNsnczRcuWODH0eYAXBsJ5gVxAUuNr7tsHSC6IZ77cA0SitzT+s47kot8Mw==}
+
+  bare-stream@2.6.5:
+    resolution: {integrity: sha512-jSmxKJNJmHySi6hC42zlZnq00rga4jjxcgNZjY9N5WlOe/iOoGRtdwGsHzQv2RlH2KOYMwGUXhf2zXd32BA9RA==}
+    peerDependencies:
+      bare-buffer: '*'
+      bare-events: '*'
+    peerDependenciesMeta:
+      bare-buffer:
+        optional: true
+      bare-events:
+        optional: true

  base64-js@1.5.1:
    resolution: {integrity: sha512-AKpaYlHn8t4SVbOHCy+b5+KKgvR4vrsD8vbvrbiQJps7fKDTkjkDry6ji0rUJjC0kzbNePLwzxq8iypo41qeWA==}
@ -13393,6 +13412,9 @@ packages:
  streamx@2.15.1:
    resolution: {integrity: sha512-fQMzy2O/Q47rgwErk/eGeLu/roaFWV0jVsogDmrszM9uIw8L5OA+t+V93MgYlufNptfjmYR1tOMWhei/Eh7TQA==}

+  streamx@2.22.0:
+    resolution: {integrity: sha512-sLh1evHOzBy/iWRiR6d1zRcLao4gGZr3C1kzNz4fopCOKJb6xD9ub8Mpi9Mr1R6id5o43S+d93fI48UC5uM9aw==}
+
  strict-event-emitter@0.5.1:
    resolution: {integrity: sha512-vMgjE/GGEPEFnhFub6pa4FmJBRBVOLpIII2hvCZ8Kzb7K0hlHo7mQv6xYrBvCL2LtAIBwFUK8wvuJgTVSQ5MFQ==}

@ -13607,8 +13629,8 @@ packages:
    resolution: {integrity: sha512-GNzQvQTOIP6RyTfE2Qxb8ZVlNmw0n88vp1szwWRimP02mnTsx3Wtn5qRdqY9w2XduFNUgvOwhNnQsjwCp+kqaQ==}
    engines: {node: '>=6'}

-  tar-fs@3.0.6:
-    resolution: {integrity: sha512-iokBDQQkUyeXhgPYaZxmczGPhnhXZ0CmrqI+MOb/WFGS9DW5wnfrLgtjUJBvz50vQ3qfRwJ62QVoCFu8mPVu5w==}
+  tar-fs@3.0.8:
+    resolution: {integrity: sha512-ZoROL70jptorGAlgAYiLoBLItEKw/fUxg9BSYK/dF/GAGYFJOJJJMvjPAKDJraCXFwadD456FCuvLWgfhMsPwg==}

  tar-stream@3.1.6:
    resolution: {integrity: sha512-B/UyjYwPpMBv+PaFSWAmtYjwdrlEaZQEhMIBFNC5oEG8lpiW8XjcSdmEaClj28ArfKScKHs2nshz3k2le6crsg==}
@ -13633,6 +13655,9 @@ packages:
    resolution: {integrity: sha512-pFYqmTw68LXVjeWJMST4+borgQP2AyMNbg1BpZh9LbyhUeNkeaPF9gzfPGUAnSMV3qPYdWUwDIjjCLiSDOl7vg==}
    engines: {node: '>=18'}

+  text-decoder@1.2.3:
+    resolution: {integrity: sha512-3/o9z3X0X0fTupwsYvR03pJ/DjWuqqrfwBgTQzdWDiQSm9KitAyz/9WqsT2JQW7KV2m+bC2ol/zqpW37NHxLaA==}
+
  text-extensions@2.4.0:
    resolution: {integrity: sha512-te/NtwBwfiNRLf9Ijqx3T0nlqZiQ2XrrtBvu+cLL8ZRrGkO0NHTug8MYFKyoSrv/sHTaSKfilUkizV6XhxMJ3g==}
    engines: {node: '>=8'}
@ -16699,10 +16724,11 @@ snapshots:
      progress: 2.0.3
      proxy-agent: 6.5.0
      semver: 7.6.3
-      tar-fs: 3.0.6
+      tar-fs: 3.0.8
      unbzip2-stream: 1.4.3
      yargs: 17.7.2
    transitivePeerDependencies:
+      - bare-buffer
      - supports-color

  '@react-dnd/asap@5.0.0': {}
@ -18663,6 +18689,7 @@ snapshots:
      chrome-launcher: 0.15.2
      puppeteer-core: 23.10.3
    transitivePeerDependencies:
+      - bare-buffer
      - bufferutil
      - supports-color
      - utf-8-validate
@ -18758,6 +18785,7 @@ snapshots:
      portfinder: 1.0.32
      source-map: 0.7.4
    transitivePeerDependencies:
+      - bare-buffer
      - bufferutil
      - supports-color
      - utf-8-validate
@ -19153,22 +19181,29 @@ snapshots:

  balanced-match@2.0.0: {}

-  bare-events@2.2.2:
+  bare-events@2.5.4:
    optional: true

-  bare-fs@2.2.3:
+  bare-fs@4.0.2:
    dependencies:
-      bare-events: 2.2.2
-      bare-path: 2.1.1
-      streamx: 2.15.1
+      bare-events: 2.5.4
+      bare-path: 3.0.0
+      bare-stream: 2.6.5(bare-events@2.5.4)
    optional: true

-  bare-os@2.2.1:
+  bare-os@3.6.1:
    optional: true

-  bare-path@2.1.1:
+  bare-path@3.0.0:
    dependencies:
-      bare-os: 2.2.1
+      bare-os: 3.6.1
+    optional: true
+
+  bare-stream@2.6.5(bare-events@2.5.4):
+    dependencies:
+      streamx: 2.22.0
+    optionalDependencies:
+      bare-events: 2.5.4
    optional: true

  base64-js@1.5.1: {}
@ -24757,6 +24792,7 @@ snapshots:
      typed-query-selector: 2.12.0
      ws: 8.18.0
    transitivePeerDependencies:
+      - bare-buffer
      - bufferutil
      - supports-color
      - utf-8-validate
@ -24770,6 +24806,7 @@ snapshots:
      puppeteer-core: 23.10.3
      typed-query-selector: 2.12.0
    transitivePeerDependencies:
+      - bare-buffer
      - bufferutil
      - supports-color
      - typescript
@ -25719,6 +25756,14 @@ snapshots:
      fast-fifo: 1.3.2
      queue-tick: 1.0.1

+  streamx@2.22.0:
+    dependencies:
+      fast-fifo: 1.3.2
+      text-decoder: 1.2.3
+    optionalDependencies:
+      bare-events: 2.5.4
+    optional: true
+
  strict-event-emitter@0.5.1: {}

  string-argv@0.3.2: {}
@ -26015,13 +26060,15 @@ snapshots:

  tapable@2.2.1: {}

-  tar-fs@3.0.6:
+  tar-fs@3.0.8:
    dependencies:
      pump: 3.0.0
      tar-stream: 3.1.6
    optionalDependencies:
-      bare-fs: 2.2.3
-      bare-path: 2.1.1
+      bare-fs: 4.0.2
+      bare-path: 3.0.0
+    transitivePeerDependencies:
+      - bare-buffer

  tar-stream@3.1.6:
    dependencies:
@ -26063,6 +26110,11 @@ snapshots:
      glob: 10.4.5
      minimatch: 9.0.5

+  text-decoder@1.2.3:
+    dependencies:
+      b4a: 1.6.4
+    optional: true
+
  text-extensions@2.4.0: {}

  text-table@0.2.0: {}